Last Updated on 7 June 2023 by Alastair Digby
Table of Contents
Welcome to our first External Attack Surface Management & Penetration Testing platform update of 2022!
We’ve been busy reviewing feedback from our customers and developing new features to support your vulnerability management program and penetration testing engagements. Today we’re excited to tell you about the new Azure Integration, an additional Critical Vulnerability Category, a new Scan Once Frequency, visibility of Open Ports and CPEs, and some smaller UI and functionality improvements. The updates will be deployed on Wednesday 19th of January 2022.
Let’s have a look at what’s new!
Azure Integration
If you use Microsoft Azure you can now integrate your Azure cloud service by clicking on the Account menu which displays the available integration options. Once you have added and verified your Azure credentials you can select which public-facing assets you want to include for scanning and set the desired scan frequency. Each cloud asset you choose will be clearly identified in the Asset view in the Environment area with an Azure icon as the Source.
New Critical Vulnerability Category
To help with risk-based prioritization there are now 4 vulnerability severity ratings instead of 3. We’ve added the severity rating of Critical which is a CVSS range 9.0-10.0 to highlight the highest level of vulnerabilities that require your urgent attention. This change was introduced in line with the vulnerability categories defined by the National Vulnerability Database (NVD).
Pro Tip!
This change will enable you to create new email alerts specifically for Critical severity vulnerabilities so you can investigate as soon as you are notified.
New Scan Frequency: Once
You can now choose a scan frequency of Once to enable an immediate and one-off scan of selected IPs and domains. This is especially helpful to check that your remediation has been successful following a recent fix. Please note that following the initial Once frequency scan has been completed you will need to change the frequency setting to Daily, Weekly, or Monthly to ensure it’s then included in your regular scheduled scans moving forward.
Open Ports & CPEs
The asset detail page view now includes visibility to your open ports and the associated services identified on those ports. This allows you to quickly see key information such as port number, protocol, service product, and more. We also include a link on the CPE section of the table which links directly to details on the NIST National Vulnerability Database.
Other Improvements and Updates
- Web application vulnerability scores have been remapped for greater granularity of risk levels
- The vulnerability detail view displays the last 5 pieces of evidence
- Vulnerabilities can now be filtered by domain for associated assets
